@event4u/agent-config 9.34.0 → 9.35.0

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Bootstrap shim for the event4u agent-config suite. This plugin ships ONLY the dispatcher hooks plus one install-pointer skill — ALL content (skills, rules, commands) is installed via `npx -y @event4u/agent-config init`, which writes the file projection AND registers the same hooks in ~/.claude/settings.json. DEPRECATED as a content channel; kept so the marketplace listing stays discoverable and existing installs keep working hooks.",
-    "version": "9.34.0",
+    "version": "9.35.0",
     "keywords": [
       "agent-config",
       "skills",

package/CHANGELOG.md

@@ -330,6 +330,97 @@ Entry-shape contract: [`docs/contracts/CHANGELOG-conventions.md`](docs/contracts
 > that forces a new era split (`# Era: 9.35.x`, etc.) — see
 > [`docs/contracts/CHANGELOG-conventions.md § Era splits`](docs/contracts/CHANGELOG-conventions.md).
 
+## [9.35.0](https://github.com/event4u-app/agent-config/compare/9.34.0...9.35.0) (2026-08-12)
+
+### Release highlights
+
+<!-- Curated head: fill before merge, keep it under 10 lines, and leave `_none_` where it is genuinely the answer. The generated log below is unchanged. -->
+- **Behaviour changes:** _auto-derived, rewrite before merge:_ rule/schema diffs, breaking commits or removed public surface in af968b5, 6d3c9f7.
+- **Default changes + migration:** _none_
+- **Security and correctness:** _none_
+- **Honest nulls:** _none_
+- **Known limitations:** _none_
+
+### Features
+
+* **leakage-allowlist:** validate the exemptions before scanning, retire position keys ([97d2c29](https://github.com/event4u-app/agent-config/commit/97d2c29ba763af06c45c5e4a4aebbed7fb531561))
+* **sessions:** refuse a claim a peer holds, and report the branch axis ([39cb3b4](https://github.com/event4u-app/agent-config/commit/39cb3b4f2e6d3c0602e5544b7079f242f5a7cd9f))
+* **council:** record the ADR-224 solo floor without enforcing it ([be09d0f](https://github.com/event4u-app/agent-config/commit/be09d0fa8f75e03b3d767f225d67cda53dd36ee8))
+* **turn-end-gate:** refuse a turn that edited a file and verified nothing ([647eca9](https://github.com/event4u-app/agent-config/commit/647eca9830a6ea9b6597a3404f37aac2fe41360d))
+* **gates:** enumerate staged confirmations behind gates --pending ([9cccf4e](https://github.com/event4u-app/agent-config/commit/9cccf4eb789f68dcc67bbf8534824212ea507845))
+* **work-engine:** exactly-once confirmed execution for a staged action ([8588e54](https://github.com/event4u-app/agent-config/commit/8588e54377062126df888b42f02155ad9e28c3b5))
+* **schemas:** add requires_confirmation to the skill and command contracts ([af968b5](https://github.com/event4u-app/agent-config/commit/af968b533a72c2358897fabcfe61bfb1baa7dc87))
+* **cli:** hooks:status --pending enumerates staged confirmations ([442bde3](https://github.com/event4u-app/agent-config/commit/442bde3bb0b047ca85d8b0e5dcb973af4343209c))
+* **work-engine:** exactly-once confirmation store plus a decision-gate seam ([9fe068c](https://github.com/event4u-app/agent-config/commit/9fe068c96a698c1d30ae74d65545b9fa301e72a3))
+* **schemas:** declare requires_confirmation on skills and commands ([6d3c9f7](https://github.com/event4u-app/agent-config/commit/6d3c9f73ccc224517a81effb5f9874f388e140ee))
+
+### Bug Fixes
+
+* **tests:** a matched grep must not fail the assertion — echo | grep -q under pipefail ([e7352cc](https://github.com/event4u-app/agent-config/commit/e7352ccedbd9cd996220db0293faf6d42a67529e))
+* **leakage-allowlist:** close the seven R2 findings, including two on this PR ([c859249](https://github.com/event4u-app/agent-config/commit/c8592492f32d6c5072eb361fde9081457855d5a7))
+* **sessions:** drop the ROADMAP_CLAIM_REL import that lost its last reference ([0d6a1c0](https://github.com/event4u-app/agent-config/commit/0d6a1c0e4670a30f7f00475d7463b986f8fa697b))
+* **session-register:** work in the PR review — path containment, token-boundary match, claim lifetime ([8e108ca](https://github.com/event4u-app/agent-config/commit/8e108ca07bae79a6058608a4bfd4b316e8d12e31))
+* **testing-anti-patterns:** close the R2 findings on the new anti-pattern ([67b747e](https://github.com/event4u-app/agent-config/commit/67b747e95bfdbf2026f5e8286a960045eb864568))
+* **session-register:** all 15 R2 findings, three of them the same shape as the bug ([871c00a](https://github.com/event4u-app/agent-config/commit/871c00a6275ed0ecf6bc3a9ea2783aa134388ec5))
+* **session-register:** key the roadmap claim on the session, and reject a stale slug ([64a9ce7](https://github.com/event4u-app/agent-config/commit/64a9ce71ad4a410fdcbed361fb8a2829c4a306ac))
+* **session-register:** compare the roadmap, not the branch name ([e338113](https://github.com/event4u-app/agent-config/commit/e338113b0adcb8d5ccb4239478bb9f2033cbc2e4))
+* **staged-confirmation:** close the round-2 findings on the hardening itself ([fa47ef6](https://github.com/event4u-app/agent-config/commit/fa47ef6253b4ae1d1612db972ed39c856ee29314))
+* **staged-confirmation:** sound the type guard and refuse a traversing token ([75dbdb3](https://github.com/event4u-app/agent-config/commit/75dbdb35fce020568fbeba978f14b521599aee67))
+* **test:** stop pipefail reporting a matched grep as a failure ([29916d1](https://github.com/event4u-app/agent-config/commit/29916d1e96e6118d9a15e84cc6eeac6de3516705))
+* **council:** record min_present on the quorum line, schema v3 to v4 ([53fe036](https://github.com/event4u-app/agent-config/commit/53fe0362b2d403455b6f7eb4e66952b1dd42e161))
+* **cli:** refuse hooks:status --pending --strict instead of exiting 0 ([7e752a9](https://github.com/event4u-app/agent-config/commit/7e752a9d6da83b7c73d97cb2996fbc7d465caf4c))
+* **confirmation:** close R2 findings 1-5 and 7 in the store and the seam ([42c6f5b](https://github.com/event4u-app/agent-config/commit/42c6f5b5b4e9f2c5835dbbf14567a6944bab13dc))
+* **council:** judge the shadow floor against the configured roster ([9cde092](https://github.com/event4u-app/agent-config/commit/9cde092cf6c745c55d9468ebb4480ffb2a11259a))
+* three CI reds — a raw NUL in a source, and a settings key declared once ([b128645](https://github.com/event4u-app/agent-config/commit/b128645e8aa29e1b8ccbab31fd3b5509e73da0da))
+
+### Documentation
+
+* **review:** re-bind the review artefact after the pipefail fix ([d4b23e1](https://github.com/event4u-app/agent-config/commit/d4b23e1c9f2620778564d81c7e0c3180e3b60eb8))
+* **review:** re-bind the review artefact after merging main ([3fc625f](https://github.com/event4u-app/agent-config/commit/3fc625f8b5d02320f62af217f7805cf85c95e91d))
+* **review:** re-bind the completion-review artefact to the fixed scope ([0fc9e82](https://github.com/event4u-app/agent-config/commit/0fc9e822c2f863216f7e721f471b070d50718157))
+* **review:** record the R2 findings before any fix ([9c66161](https://github.com/event4u-app/agent-config/commit/9c66161c76484a856b1293918074bcf387683d9b))
+* **testing-anti-patterns:** the negative test that passes for the wrong reason ([8fb3f84](https://github.com/event4u-app/agent-config/commit/8fb3f84a7a9c009a53dd383ac8a86bfe00de4fe6))
+* state the collision that cost a PR, and the two axes that catch it ([60c0df8](https://github.com/event4u-app/agent-config/commit/60c0df808af87a748643d1fbfe2310a9a08f2c25))
+* **review:** record the R2 completion-review findings before fixing them ([35570a5](https://github.com/event4u-app/agent-config/commit/35570a5df0be0cd402f8cc9ed3e5f5cf817a02d1))
+* **roadmap:** close and archive the solo-floor roadmap ([128b2cd](https://github.com/event4u-app/agent-config/commit/128b2cddbadf12825bb220cc2aef261976ccb023))
+* **adr:** answer ADR-224 three open questions in an amendment ([ff2362e](https://github.com/event4u-app/agent-config/commit/ff2362e1971dadd3b547fbfeadf2650dbb3a4c3f))
+
+### Refactoring
+
+* **leakage-allowlist:** key 35 exemptions on content, drop 3 that were dead ([de96358](https://github.com/event4u-app/agent-config/commit/de96358ddb309be1d4ffa4035d3b8e55e8e08458))
+
+### Tests
+
+* **session-register:** pin all five failure modes, each with the case that was silent ([7f35c3b](https://github.com/event4u-app/agent-config/commit/7f35c3bce8118d3112217af6d20dabdae487b301))
+* **schemas:** validate the command surface instead of reading its shape ([5b75e64](https://github.com/event4u-app/agent-config/commit/5b75e64cc6f988212aabaaa84e82ebb4940681e0))
+
+### Build
+
+* refresh dist/install/install.mjs for the new settings key ([a4a99ed](https://github.com/event4u-app/agent-config/commit/a4a99edd6132f92d6e975ccba3261939964c015b))
+
+### Chores
+
+* **review:** re-bind the artefact and mark all seven findings fixed ([fb6283f](https://github.com/event4u-app/agent-config/commit/fb6283fa2011650986c89eb514e0be80d2ffd9c0))
+* **memory:** drop three docblock claims about the removed agent-memory path ([307a355](https://github.com/event4u-app/agent-config/commit/307a3550fce6e81dfeb42b0124e276b762da9d66))
+* **review:** record seven R2 findings before fixing them ([c86bf3d](https://github.com/event4u-app/agent-config/commit/c86bf3daa3e3281416c9ce426fe1560084dbb1b7))
+* **mcp:** drop the agent-memory declaration ADR-094 left behind ([4283a8e](https://github.com/event4u-app/agent-config/commit/4283a8efad4ee9ed721404d3a68aff0b367ad690))
+* **review:** re-bind the artefact and mark all three findings fixed ([d2a0c54](https://github.com/event4u-app/agent-config/commit/d2a0c544c80a5e20f0cd7b7d338cbf17684b7c87))
+* **review:** record the R2 findings on the anti-pattern addition ([b382dd1](https://github.com/event4u-app/agent-config/commit/b382dd1bfe1b4c3a1301358eb667692e5bc606d0))
+* **lint:** re-anchor the leakage allowlist after the inserted paragraph ([8bef27e](https://github.com/event4u-app/agent-config/commit/8bef27e8adae4e742350970323232981d8b499d0))
+* **dist:** project the testing-anti-patterns addition ([c6fcd4a](https://github.com/event4u-app/agent-config/commit/c6fcd4ae50fbd6caaa7cc3d7b3fcf8751283815f))
+* **review:** re-bind round 2 and mark its three findings fixed ([40e110c](https://github.com/event4u-app/agent-config/commit/40e110c7203b121b0e15f6ad5de0217efb1d90c8))
+* **review:** record the R2 round-2 findings before fixing them ([0e477f3](https://github.com/event4u-app/agent-config/commit/0e477f357071e4bc2dc69786ce4e24c1ebf50e75))
+* **review:** re-bind the R2 artefact after merging main ([756b226](https://github.com/event4u-app/agent-config/commit/756b226de64ec1a581338b07954a2e4e948b758f))
+* **roadmap:** regenerate the dashboard after the main merge ([ba9a0ad](https://github.com/event4u-app/agent-config/commit/ba9a0ade70f40447b6eb3a43736b32376bad56e1))
+* **review:** re-bind the R2 artefact and mark all eight findings fixed ([081ffff](https://github.com/event4u-app/agent-config/commit/081ffffbee9d0c9d28e380e148ce29f27aa5d793))
+* **review:** record the R2 completion review for dispatch-safety Phase 2 ([661947d](https://github.com/event4u-app/agent-config/commit/661947def61068d05c832146723366fd5abda225))
+* **config:** register shadow_floor_fire_rate as the fifth attendance metric ([70abe5c](https://github.com/event4u-app/agent-config/commit/70abe5c0118085fadd01a2eec14433814bf405c5))
+* **roadmap:** close dispatch-safety 2.1-2.3 and 4.3, regenerate the dashboard ([bb8dd69](https://github.com/event4u-app/agent-config/commit/bb8dd69b31893ea235e3159ef48b5180e3385b6d))
+* **dist:** project the confirmation module and the gate seam ([d6905af](https://github.com/event4u-app/agent-config/commit/d6905af2385948a7bb44dbdb3a9025834b91afb2))
+* **roadmap:** close dispatch-safety Phase 2, record the 4.3 severity probe ([be0f893](https://github.com/event4u-app/agent-config/commit/be0f893e57001ca8a3a8c4c4a21538f37266f410))
+
+Tests: 13213 (+145 since 9.34.0)
+
 ## [9.34.0](https://github.com/event4u-app/agent-config/compare/9.33.0...9.34.0) (2026-08-11)
 
 ### Release highlights

package/CONTRIBUTING.md

@@ -25,20 +25,29 @@ so we can align on direction before code is written.
 
 If you are unsure whether a change is in scope: open a discussion first.
 
-## Dependency direction — no circular deps with `agent-memory`
-
-`agent-config` is the upstream, standalone package. It must **never**
-hard-depend on `@event4u/agent-memory`. The optional companion package
-is declared in `suggest` (Composer) / `optionalDependencies` or
-documentation only (npm) — never as a runtime or dev dependency that
-`composer install` / `npm install` would pull automatically.
-
-Reasoning: `agent-memory` depends on `agent-config` for its skills and
-governance. Reversing that would create a circular dependency and break
-installs in consumer projects that only want the rule/skill layer.
-
-See [`agents/roadmaps/road-to-memory-self-consumption.md`](agents/roadmaps/road-to-memory-self-consumption.md)
-for the full conflict-resolution contract between the two packages.
+## Dependency direction — memory is file-first, with no external backend
+
+`agent-config` is the upstream, standalone package. Its memory layer is
+file-first and self-contained: curated YAML under `agents/memory/<type>/`
+plus agent-written JSONL under `agents/memory/intake/`, read by `retrieve()`
+in `src/scripts/memory_lookup.ts`. There is no external memory backend.
+
+[ADR-094](docs/decisions/ADR-094-agent-memory-layer-removal.md) removed the
+`@event4u/agent-memory` binding — the provider seam, the package detection,
+and the MCP routing that used it "when present" — and explicitly rejected
+leaving the integration surface inert: *"a dormant integration surface
+advertising a capability the suite no longer has is misleading residue."*
+
+Two rules survive that removal, and both are unconditional:
+
+- **Never hard-depend on a package that depends on `agent-config`.** That was
+  the case for `agent-memory`, so the dependency could only ever run one way;
+  reversing it would create a cycle and break installs in consumer projects
+  that want the rule/skill layer alone.
+- **Adding any external memory backend is a Class-B decision** under
+  [ADR-124](docs/decisions/ADR-124-embedded-engine-doctrine.md) § 5 — its own
+  ADR, a named consumer demand signal, and a measured Class-A failure — never
+  a dependency bump or a config entry.
 
 ## Quick start for contributors
 

package/dist/agent-src/commands/roadmap/next.md

@@ -42,9 +42,14 @@ git fetch origin --prune
 git ls-tree --name-only origin/main agents/roadmaps/          # still active?
 git ls-tree --name-only origin/main agents/roadmaps/archive/   # already closed?
 gh pr list --state open --json number,title,headRefName        # in flight?
-agent-config sessions:list --json                              # claimed right now?
+agent-config sessions:list                                     # claimed right now?
 ```
 
+`sessions:list` without `--json` on purpose: the human form carries **both**
+axes — the live records AND the unmerged branches checked out in other
+worktrees. `--json` returns only the records unless `--branches` is passed, and
+the branch axis is the one that does not need a peer to have claimed anything.
+
 Excluded from the candidate set: `template.md`, `archive/`,
 `skipped/`, `later/`, anything with `status: draft` whose promotion
 trigger has not fired, and:
@@ -53,12 +58,24 @@ trigger has not fired, and:
 |---|---|---|---|
 | **taken by an open PR** | `gh pr list` — a roadmap slug matching an open PR's branch | The work is done or nearly done and is waiting on review | Review or merge that PR; the roadmap archives inside it |
 | **claimed by a live session** | `sessions:list` — a live record whose `roadmap_slug` matches | Another session is working on it *right now*, before any PR exists | Nothing to do — it releases on that session's end, or by TTL |
+| **held by a foreign worktree** | `sessions:list` — an unmerged branch in another worktree whose name names this roadmap | A peer is already writing code, whether or not it ever claimed | Pick something else; a branch on disk outranks an unwritten claim |
 
-Keep the two distinguishable in the reported screen. They are different
+Keep the three distinguishable in the reported screen. They are different
 states with different recovery, and collapsing them into "unavailable"
 loses the only information that tells the user whether to wait for a
 review or simply pick something else.
 
+```
+A DIFFERENT BRANCH NAME DOES NOT MAKE IT A DIFFERENT TASK.
+MEASURED TWICE: TWO SESSIONS BUILT ONE ROADMAP PHASE UNDER
+`feat/dispatch-safety-confirmation` AND `feat/dispatch-safety-confirmed-execution`,
+AND ONE OF THE TWO PRs WAS THROWN AWAY. COMPARE THE ROADMAP, NEVER THE BRANCH.
+```
+
+A slug in the register that names **no open roadmap** is not a claim — it is a
+stale field left behind after that roadmap archived. `sessions:list` labels it
+`← STALE`; read it as "nobody claimed anything", never as "taken".
+
 A roadmap completes by an archive move **inside its merging PR**, so a
 local checkout can show a closed roadmap as open. That is why this step
 precedes the screen instead of following it.
@@ -145,9 +162,24 @@ agent-config sessions:claim <roadmap-slug>
 ```
 
 Immediately after the pick, before any branch or commit. This writes the slug
-into `agents/runtime/state/roadmap-claim.json`; the next heartbeat lifts it into
-this session's register record, so another session's step 1 excludes it **within
-one turn** and long before a PR exists.
+into `agents/runtime/state/roadmap-claim-<session>.json`; the next heartbeat lifts
+it into this session's register record, so another session's step 1 excludes it
+**within one turn** and long before a PR exists.
+
+The file is keyed on the host session id, not on the worktree, and that
+distinction was a measured defect rather than a nicety: with one shared file per
+checkout, four live records once carried one identical slug — naming an
+already-archived roadmap — because every session in that checkout read the last
+claim written there. A session that inherits a peer's claim reports work it is
+not doing, and the peer whose claim was overwritten reports none. On a host that
+exports no session id the legacy shared path is still written and still read, and
+`sessions:claim` says so on that path rather than implying a guarantee it cannot
+give.
+
+**The claim is also what makes the duplicate-work warning possible.** Without it
+the register can only compare branch names, and two sessions on one roadmap
+routinely pick two different names — so a skipped claim does not merely delay
+visibility, it removes the only axis that sees the expensive collision.
 
 Routing the claim through a state file rather than having this command write the
 register directly is deliberate: the roadmap is picked mid-session by the model,

package/dist/agent-src/scripts/roadmap_gates.ts

@@ -46,6 +46,13 @@
  *   ./agent-config gates --all      # every open blocker, grouped by owner
  *   ./agent-config gates --json     # machine-readable
  *   ./agent-config gates --reply    # reply-close form; empty when none
+ *   ./agent-config gates --pending  # staged actions awaiting confirmation
+ *
+ * `--pending` reads a different source — the staged-confirmation store, not the
+ * roadmap tree — and stays out of `--reply` on purpose. ADR-222 fixes the
+ * reply-close form at exactly ONE decision rendered in full; folding a second
+ * source into it would silently change which decision "the one" is, and that
+ * contract is not this step's to move.
  */
 
 import * as path from 'node:path';
@@ -58,6 +65,8 @@ import {
     blocker_needs_user as needsUser,
     type Blocker,
 } from './update_roadmap_progress.js';
+import { listPending } from '../templates/scripts/work_engine/hooks/builtin/staged_confirmation_store.js';
+import type { StagedAction } from '../templates/scripts/work_engine/hooks/builtin/staged_confirmation.js';
 
 const _HERE = fileURLToPath(import.meta.url);
 
@@ -327,6 +336,89 @@ function renderJson(entries: readonly Entry[], all: boolean): string {
     );
 }
 
+/**
+ * `--pending`: staged actions awaiting a human confirmation.
+ *
+ * A second source under the same verb, and the reason it belongs here rather
+ * than in a new command is the verb's own definition — "open decisions that
+ * need you, as actions". A staged irreversible action IS one, and the most
+ * literal kind: the roadmap blockers above are decisions a human owes a plan,
+ * this is a decision a human owes an action that is already loaded and waiting.
+ *
+ * Expired stages are counted, never listed as actionable. An expired stage
+ * cannot execute (`stageStatus` derives that from the clock, not from a sweep
+ * having run), so rendering it beside a live one would put two rows in front of
+ * the reader where only one is a decision.
+ */
+function renderPending(root: string, now: number): string {
+    const rows = listPending(root, now);
+    const live = rows.filter((r) => r.status === 'pending');
+    const expired = rows.filter((r) => r.status === 'expired');
+    const lines: string[] = [];
+
+    if (live.length === 0) {
+        lines.push(
+            expired.length === 0
+                ? 'No staged actions awaiting confirmation.'
+                : `Nothing awaits your confirmation. ${expired.length} stage` +
+                      `${expired.length !== 1 ? 's' : ''} expired unconfirmed — the action never fired.`,
+        );
+        return lines.join('\n') + '\n';
+    }
+
+    lines.push(
+        `${live.length} staged action${live.length !== 1 ? 's' : ''} await` +
+            `${live.length === 1 ? 's' : ''} your confirmation` +
+            (expired.length > 0 ? ` · ${expired.length} expired unconfirmed` : ''),
+    );
+    let n = 0;
+    for (const { stage } of live) {
+        n += 1;
+        lines.push(...renderStage(stage, n));
+    }
+    lines.push('');
+    return lines.join('\n') + '\n';
+}
+
+function renderStage(stage: StagedAction, index: number): string[] {
+    const head = `${index} · ${stage.action}`;
+    const tail = `token: ${stage.token}`;
+    const dashes = Math.max(3, WIDTH - head.length - tail.length - 6);
+    return [
+        '',
+        `── ${head} ${'─'.repeat(dashes)} ${tail}`.trimEnd(),
+        // The object is the first field on purpose: an approval that does not
+        // name the exact object is the thing non-destructive-by-default forbids,
+        // so it is what the reader must see before anything else.
+        ...field('Object:', stage.object),
+        ...field('Staged by:', stage.source),
+        ...field('Expires:', stage.expires_at),
+    ];
+}
+
+function renderPendingJson(root: string, now: number): string {
+    const rows = listPending(root, now);
+    return (
+        JSON.stringify(
+            {
+                awaitingYou: rows.filter((r) => r.status === 'pending').length,
+                expired: rows.filter((r) => r.status === 'expired').length,
+                staged: rows.map(({ stage, status }) => ({
+                    token: stage.token,
+                    action: stage.action,
+                    object: stage.object,
+                    source: stage.source,
+                    stagedAt: stage.staged_at,
+                    expiresAt: stage.expires_at,
+                    status,
+                })),
+            },
+            null,
+            2,
+        ) + '\n'
+    );
+}
+
 function _isDir(p: string): boolean {
     try {
         return fs.statSync(p).isDirectory();
@@ -340,8 +432,8 @@ function _isDir(p: string): boolean {
  * `agents/roadmaps`, otherwise fall back to the git toplevel (monorepo
  * sub-project support).
  */
-function _resolveRepoRoot(start: string): string {
-    if (_isDir(path.join(start, 'agents', 'roadmaps'))) {
+function _resolveRepoRoot(start: string, marker = path.join('agents', 'roadmaps')): string {
+    if (_isDir(path.join(start, marker))) {
         return start;
     }
     try {
@@ -351,7 +443,7 @@ function _resolveRepoRoot(start: string): string {
             timeout: 10_000,
         });
         const top = (r.stdout || '').trim();
-        if (r.status === 0 && top !== '' && _isDir(path.join(top, 'agents', 'roadmaps'))) {
+        if (r.status === 0 && top !== '' && _isDir(path.join(top, marker))) {
             return top;
         }
     } catch {
@@ -365,6 +457,18 @@ function main(argv?: readonly string[]): number {
     const all = args.includes('--all');
     const json = args.includes('--json');
     const reply = args.includes('--reply');
+    const pending = args.includes('--pending');
+
+    // `--pending` resolves against `agents/runtime/`, not `agents/roadmaps/`,
+    // and is answered BEFORE the roadmaps-directory exit below: a staged action
+    // is independent of whether this project plans in roadmaps at all, so
+    // "no roadmaps here" is not an answer to "what awaits my confirmation".
+    if (pending) {
+        const root = _resolveRepoRoot(process.cwd(), path.join('agents', 'runtime'));
+        const now = Date.now();
+        process.stdout.write(json ? renderPendingJson(root, now) : renderPending(root, now));
+        return 0;
+    }
 
     const repoRoot = _resolveRepoRoot(process.cwd());
     const roadmapRoot = path.join(repoRoot, 'agents', 'roadmaps');
@@ -412,5 +516,16 @@ if (_isCliEntry()) {
     process.exitCode = main();
 }
 
-export { main, needsUser, regroupTodo, wrap, collectEntries, render, renderJson, renderReply };
+export {
+    main,
+    needsUser,
+    regroupTodo,
+    wrap,
+    collectEntries,
+    render,
+    renderJson,
+    renderReply,
+    renderPending,
+    renderPendingJson,
+};
 export type { Entry };

package/dist/agent-src/skills/testing-anti-patterns/SKILL.md

@@ -163,6 +163,27 @@ expect([403, 404]).toContain((await api.get(`/users/${otherTenantUser.id}`)).sta
 
 Deriving from seeded data is necessary but **not sufficient** — a test that only reads back the exact fields it seeded is still overfit (a mutation in the code survives it). A real test also exercises boundary (empty / null / max / Unicode), error (missing / invalid), and, on security-sensitive paths, an abuse case (IDOR, injection string, XSS payload). Coverage of *cases*, not just lines.
 
+**The adversarial variant, and it is the one that looks safest.** A *negative* test — the abuse case just named — fails the same way, but nothing about it reads as weak: it names an attack, it asserts a refusal, it goes green. It passes because **something other than the control under test** produced that refusal. Two shapes, both from one real review:
+
+- **The hostile value sits only in the argument.** A guard rejecting a path-traversing `token` was pinned by planting a fixture whose own `token` field held the *legitimate* value while `'../outside'` was passed as the argument. Downstream, an ordinary token comparison mismatched and returned exactly the expected refusal — delete the guard and the test still passes. The hostile value belongs in the **field under test**, not only in the call.
+- **The assertion cannot fail.** The same test asserted the planted file still existed after a rejected claim. The two directories were siblings, so both `../x.json` joins resolved to one path and the rename could never have moved it — a green no implementation could turn red.
+
+Gate:
+
+```
+BEFORE trusting a negative test:
+  Delete or invert the control it claims to pin. Does it FAIL?
+  RESTORE THE CONTROL IMMEDIATELY — before any other edit, before any commit.
+    The mutation is a probe, never a change. A deleted guard left deleted is
+    a shipped vulnerability produced by a test-quality check.
+  IF it still passes: it is pinning something else. Name what, then fix the test.
+  IF an assertion cannot fail for ANY implementation: delete THE ASSERTION —
+    it is decoration. Only after proving vacuity, and never to turn a red test
+    green — that is Anti-Pattern 7 below.
+```
+
+No mutation-testing rig required: comment the control out, run that one spec, put it back. A negative test nobody has ever watched fail is a claim, not evidence.
+
 ### Anti-Pattern 7 — Gaming the green (test-integrity)
 
 Symptom: a test fails, and the "fix" edits the *test* instead of the code — `.skip` / `it.skip` / `xfail` / `@Disabled` on the failing case, deleting the failing assertion, loosening `toBe(x)` to `toBeTruthy()`, or rewriting the `expected` value to whatever the (possibly buggy) code now emits. The suite goes green while the behavior stays broken — the worst outcome, because green now *hides* the bug. This is the automation-bias trap: under pressure to finish, the agent optimizes the signal (green) instead of the target (correct behavior).
@@ -211,6 +232,7 @@ This is the test-surface instance of the `autonomous-execution` N=3 / allowlist-
 - Do NOT mark a story complete until at least one test was watched failing first.
 - Do NOT hardcode an expected value the code will emit, or pin a regex to an incidental fixed date/id — derive from inputs and seeded data, and vary the input across cases.
 - Do NOT skip / `xfail` / delete a failing test, or rewrite its `expected` to the code's current output, to get a green run — fix the code, or state a real spec change in the diff.
+- Do NOT trust a negative test you have never watched fail — delete the control it pins, confirm the test goes red, restore the control immediately.
 
 ## Auto-trigger keywords
 
@@ -225,6 +247,9 @@ This is the test-surface instance of the `autonomous-execution` N=3 / allowlist-
 - gaming the green
 - skip failing test
 - test integrity
+- negative test
+- vacuous assertion
+- abuse-case test
 
 ## Provenance
 

package/dist/agent-src/templates/agents/agent-project-settings.example.yml

@@ -39,7 +39,7 @@ schema_version: 1
 # CI guard: a release bump of `package.json` must update this value
 # in lockstep — see scripts/check_template_pin_drift.ts (road-to-
 # portable-runtime-and-update-check P3.3).
-agent_config_version: "9.34.0"
+agent_config_version: "9.35.0"
 
 # --- Project identity ---
 project:

package/dist/agent-src/templates/scripts/memory_lookup.ts

@@ -388,8 +388,7 @@ function* _iter_knowledge_entries(): Generator<[string, Record<string, unknown>]
 /**
  * Naive relevance score: max over keys of (glob-match | substring).
  *
- * Good enough for the `absent` path where retrieval is best-effort.
- * The `present` path returns a real score from agent-memory.
+ * Retrieval is best-effort by design — this is the only scoring path.
  */
 export function _score(entry: Record<string, unknown>, keys: string[]): number {
     if (keys.length === 0) {

package/dist/agent-src/templates/scripts/memory_signal.ts

@@ -214,10 +214,8 @@ export interface SignalRecord {
 /**
  * Append a signal entry. Returns the written record, or null when skipped.
  *
- * On `present` backend, routing to the package is a no-op here today —
- * the package adapter is wired in `road-to-agent-memory-integration.md`
- * Phase 3. For now, the file path is the single source of truth so
- * merge-safety is preserved in every mode.
+ * The file path is the single source of truth: there is no external backend
+ * to route to, so merge-safety holds in every mode.
  */
 export function emit(
     entry_type: string,

package/dist/agent-src/templates/scripts/work_engine/hooks/builtin/decision_gate.ts

@@ -41,6 +41,22 @@ type Any = unknown;
 
 const _BLOCK_REASON_PREFIX = 'decision_gate';
 
+/**
+ * Stage an action for confirmation and return the surface lines that name it.
+ *
+ * An injected collaborator rather than a direct import of
+ * `staged_confirmation_store.js`, for two reasons. The gate is called from a
+ * hook bus with no repo root and no clock of its own, and — the load-bearing
+ * one — an absent stager keeps the `ask` path byte-identical to what ships
+ * today. The confirmation primitive is deliberately UNBOUND until blocker
+ * `confirmation-degraded-host-semantics` is decided (5 of 8 hosts have no
+ * `pre_tool_use` slot), so reaching it has to be an explicit opt-in and not a
+ * behaviour change that arrives with an upgrade.
+ */
+export interface ConfirmationStager {
+    stage(input: { action: string; object: string; source: string }): readonly string[];
+}
+
 /**
  * Evaluate decision-engine gates on every `AFTER_STEP`.
  *
@@ -49,9 +65,11 @@ const _BLOCK_REASON_PREFIX = 'decision_gate';
  */
 export class DecisionGateHook {
     private readonly _settings: DecisionEngineSettings;
+    private readonly _stager: ConfirmationStager | null;
 
-    constructor(settings: DecisionEngineSettings) {
+    constructor(settings: DecisionEngineSettings, stager: ConfirmationStager | null = null) {
         this._settings = settings;
+        this._stager = stager;
     }
 
     /** Register the gate callback on `AFTER_STEP`. */
@@ -109,10 +127,22 @@ export class DecisionGateHook {
                 DecisionGateHook._surface(decision, 'ask_timeout'),
             );
         }
-        throw new HookHalt(
-            `${_BLOCK_REASON_PREFIX}:${decision.gate_id}`,
-            DecisionGateHook._surface(decision),
-        );
+        // `stop` and `ask` share this exit: both halt, which is the policy —
+        // ask and action are strictly sequential, so an interactive gate does
+        // not act while it asks. What `ask` adds, and only when a stager is
+        // injected, is a token on the surface so the answer can be matched to
+        // THIS question and consumed exactly once. The halt reason is
+        // deliberately unchanged: it is the identity downstream readers match on.
+        let surface = DecisionGateHook._surface(decision);
+        if (action === 'ask' && this._stager !== null) {
+            const extra = this._stager.stage({
+                action: `work_engine:advance:${decision.gate_id}`,
+                object: `phase ${decision.phase}`,
+                source: _BLOCK_REASON_PREFIX,
+            });
+            surface = [...surface, '', ...extra];
+        }
+        throw new HookHalt(`${_BLOCK_REASON_PREFIX}:${decision.gate_id}`, surface);
     }
 
     // -- formatting helpers -------------------------------------------